provider "alicloud" {
  region                = local.region
  version               = "1.199"
}

terraform {
  required_version      = "~> 0.12"  
  backend "oss" {
    bucket              = "deeproute-terraform-resources"
    key                 = "prod/services/prod-ack-eci-cluster"
    tablestore_endpoint = "https://terraform-status.cn-shenzhen.ots.aliyuncs.com"
    tablestore_table    = "terraform_statelock_table"    
    region              = "cn-shenzhen"
  }
}

locals {
  region                = "cn-shenzhen"
  env                   = "prod"
  name                  = "ack-eci-cluster"
  billing               = "team-cloud"
  team                  = "cloud"
}

locals {
  public_vpc                    = "vpc-wz977po0izhjhwqm3auvt"
  public_vswitch                = "vsw-wz9uj46ac7yj3n7hxw05a"
  # prod_cloudbox_vswitch           = "vsw-wz9tjkkacp52e0gnkaqx5"
  availability_zone               = "cn-shenzhen-d"
}

locals {
  version               = "1.22.15-aliyun.1"
  pod_cidr              = "172.31.0.0/16"
  service_cidr          = "192.168.1.0/16"
  image_id              = "aliyun_2_1903_x64_20G_alibase_20221102.vhd"
}

module "ack_sg" {
  # source                = "../../../modules/alicloud/sg"
  source                = "git@code.deeproute.ai:deeproute-org/cloud/cloud/k8s-deployment/ops-terraform.git//alicloud/sg?ref=module.v1.0.4"
  sg_type               = "enterprise"
  vpc_id                = local.public_vpc
  sg_name               = "${local.env}-${local.name}"
  sg_description        = "security group of ACS Cluster [${local.env}-${local.name}]"
  inbound_rules         = {
    "0" = [local.pod_cidr, "-1/-1", "all", "放行pod_cidr地址段"] 
    "1" = ["10.246.0.0/16", "-1/-1", "all", "放行Ack集群VPC地址段"]
    "2" = ["0.0.0.0/0", "-1/-1", "icmp", "允许Ping"]
    "3" = ["10.24.0.0/22", "6443/6443", "tcp", "允许深圳办公网络对Apiserver访问"]
    "4" = ["100.104.0.0/16", "22/22", "tcp", "允许阿里云Workbench远程连接"]
    "5" = ["10.24.97.245/22", "22/22", "tcp", "允许qianghu固定地址远程连接"]
    "6" = ["10.24.35.191/22", "22/22", "tcp", "允许qianghu WiFi地址远程连接"]
  }
}

module "ack_control_plane" {
  # source                  = "../../../modules/alicloud/ack/cs_managed_kubernetes"
  source                  = "git@code.deeproute.ai:deeproute-org/cloud/cloud/k8s-deployment/ops-terraform.git//alicloud/ack/cs_managed_kubernetes?ref=module.v1.0.4"
  ack_name                = "${local.env}-${local.name}"
  ack_version             = local.version
  ack_worker_vswitch_ids  = [local.public_vswitch]
  ack_k8s_pod_cidr        = local.pod_cidr
  ack_k8s_service_cidr    = local.service_cidr
  ack_security_group_id   = module.ack_sg.sg_id
  cluster_addons          = [
    { name: "arms-prometheus", config: "", disabled: true },
    { name: "nginx-ingress-controller", config: "", disabled: true },
    { name: "alicloud-monitor-controller", config: "", disabled: true },
    { name: "storage-operator", config: "", disabled: true },
    { name: "metrics-server", config: "", disabled: false },
    { name: "logtail-ds", config: "{\"IngressDashboardEnabled\":\"false\"}", disabled: true },
    { name: "ack-node-local-dns", config: "", disabled: false },
    { name: "security-inspector", config: "", disabled: true },    
    { name: "ack-node-problem-detector", config: "{\"sls_project_name\":\"k8s-log-${local.env}-${local.name}-worker\"}", disabled: false }
  ]
  tags = {
    Name                  = local.name
    Environment           = local.env
    Billing               = local.billing
    Team                  = local.team
  }
}

# NodeGroupName-v{a}-v{b}-v{c}
#   a: cluster version
#   b: k8s version
#   c: node group version

module "ack_worker_node_pool_v1" {
  # source                          = "../../../modules/alicloud/ack/cs_kubernetes_node_pool"
  source                          = "git@code.deeproute.ai:deeproute-org/cloud/cloud/k8s-deployment/ops-terraform.git//alicloud/ack/cs_kubernetes_node_pool?ref=module.v1.0.4"
  ack_cluster_name                = module.ack_control_plane.cluster_name
  ack_cluster_id                  = module.ack_control_plane.cluster_id
  ack_node_count                  = "2"
  ack_node_pool_name              = "public-worker-node-v1-v1-22-v1"
  ack_vswitch_ids                 = [local.public_vswitch]
  ack_image_id                    = local.image_id
  ack_instance_availability_zone  = local.availability_zone
  ack_instance_cpu_core_count     = "8"
  ack_instance_memory_size        = "16"
  ack_instance_type_family        = "ecs.c6"
  ack_security_group_ids          = [module.ack_sg.sg_id]
  # ack_scaling_config          = [{
  #   min_size                    = "2"
  #   max_size                    = "10"
  #   type                        = "cpu"
  #   is_bond_eip                 = false
  #   eip_internet_charge_type    = "PayByTraffic"
  #   eip_bandwidth               = "0"        
  # }]
  # ack_kubelet_configuration       = [{
  #   registry_pull_qps = "10"
  #   registry_burst  = "5"
  #   event_record_qps  = "10"
  #   event_burst = "5"
  #   system_reserved_cpu = "1500m"
  #   system_reserved_memory  = "2Gi"
  #   kube_reserved_cpu = "1500m"
  #   kube_reserved_memory ="1Gi"
  # }]
  ack_cluster_labels              = [{
    key = "resources-group"
    value = "large"
  }]    
  tags = {
    Name                  = local.name
    Environment           = local.env
    Billing               = local.billing
    Team                  = local.team
  }  
}

module "ack_admin_policy" {
  source                        = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/ram/policy?ref=module.v1.0.2"
  ram_policy_name               = "${local.env}-${local.name}-admin-policy"
  ram_policy_document           = <<EOF
  {
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "cs:Get*",
                  "cs:List*",
                  "cs:Describe*",
                  "cs:Create*",
                  "cs:Modify*",
                  "cs:Scale*",
                  "cs:Remove*",
                  "cs:Delete*",
                  "cs:Sync*",
                  "cs:DescribeAddons"
              ],
              "Resource": "acs:cs:*:*:cluster/${module.ack_control_plane.cluster_id}"
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:DescribeInstanceAttribute",
                  "ecs:DescribeInstances"
              ],
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": "cs:DescribeKubernetesVersionMetadata",
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": "smartag:*",
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": "cen:*",
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": "arms:*",
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": "log:*",
              "Resource": "*"
          },
          {
            "Action": "cs:*",
            "Effect": "Allow",
            "Resource": "*"
          }           
      ]
  }
  EOF
}